InfoSecBulletin Cybersecurity for mankind
TP-Link has revealed several serious security flaws in Aginet networking products managed by ISPs. This includes mesh systems, routers, PON devices, and xDSL modems.
The flaws might let attackers who can connect to the network get around checks, gain higher access, steal important data, look at device files, and run system commands.
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
The security notice, updated on August 10, 2026, lists problems as CVE-2025-30237 to CVE-2025-30241. Internet service providers usually supply, set up, and update the affected products, so firmware may change depending on the provider and area.
The main flaw, CVE-2025-30237, is a way to get around logging in on the web management page. It has a CVSS v4 score of 8.7 and happens because of failed access rules on some links.
An attacker on a nearby network can send special requests to access important functions without login details. If this happens, the attacker could take complete control of the device.
| CVE | Vulnerability | Severity |
|---|---|---|
| CVE-2025-30237 | Authentication bypass | High |
| CVE-2025-30238 | Privilege escalation | High |
| CVE-2025-30239 | Sensitive data exposure | High |
| CVE-2025-30240 | Arbitrary file read | Medium |
| CVE-2025-30241 | OS command injection | High |
Multiple TP-Link Flaws
CVE-2025-30238, rated 8.6, is a mistake in user-management that lets low-level users do admin tasks. This means they might create special accounts or change important settings. An attacker with little access could gain more control over a router or mesh node.
Another high-severity issue, CVE-2025-30239, involves hardcoded cryptographic keys stored in firmware. The vulnerability has a CVSS score of 8.5.
An attacker with access to the device’s storage could recover the embedded keys and decrypt protected configuration data. Exposed information may include credentials and ISP-related service settings, creating a risk of further compromise.
CVE-2025-30240 is a medium-severity arbitrary file-read issue with a CVSS score of 5.1. The flaw affects the USB HTTPS access path and stems from improper handling of symbolic links on external USB storage.
A person who can physically reach the device might make a harmful symbolic link on a supported device and use it to get to important files in the router’s system.
The last flaw, CVE-2025-30241, is a serious flaw that lets attackers run commands on the OS. It has a high danger level of 8.6. This happens because some web parts do not check user input correctly before sending it to system commands.
An attacker on the local network could send commands and run them with higher access, possibly gaining full control of the device. The affected devices are from TP-Link’s HB, HX, HC, EB, EC, EX, XC, XX, and VX series.
HB810, HB710, EX220, EX222, EX920, EC220-G5, XX530v, and VX1800v are some examples. The effect varies based on the model for the area, hardware type, ISP changes, and the firmware installed.
TP-Link said that fixing ISP-managed devices will be done with the help of service providers. Often, updates can be installed automatically using ISP management tools.
Users need to look at the router’s admin page or the provider’s app for firmware updates. If there is no update, customers should reach out to their ISP to see if their device is impacted and when a fix will be available.
Users should limit access to management tools because some problems need local or nearby network access. They should use strong, different passwords for administrators, disable unneeded remote management options, and keep untrusted users away from the local network.
